Data Pipelines roles and permissions

This page lists the IAM roles and permissions for Data Pipelines. Tosearch through all roles and permissions, see therole andpermission index.

Data Pipelines roles

RolePermissions

Data pipelines Admin

(roles/datapipelines.admin)

Administrator of Data pipelines resources

datapipelines.*

  • datapipelines.jobs.list
  • datapipelines.pipelines.create
  • datapipelines.pipelines.delete
  • datapipelines.pipelines.get
  • datapipelines.pipelines.list
  • datapipelines.pipelines.run
  • datapipelines.pipelines.stop
  • datapipelines.pipelines.update

resourcemanager.projects.get

resourcemanager.projects.list

Data pipelines Invoker

(roles/datapipelines.invoker)

Invoker of Data pipelines jobs

datapipelines.pipelines.run

resourcemanager.projects.get

resourcemanager.projects.list

Datapipelines Service Agent

(roles/datapipelines.serviceAgent)

Gives Datapipelines service permissions to create Dataflow & Cloud Scheduler jobs in the user project.

Warning: Do not grant service agent roles to any principals exceptservice agents.

appengine.applications.get

bigquery.tables.get

bigtable.tables.get

cloudbuild.builds.create

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.builds.update

cloudbuild.locations.*

  • cloudbuild.locations.get
  • cloudbuild.locations.list

cloudbuild.operations.*

  • cloudbuild.operations.get
  • cloudbuild.operations.list

cloudscheduler.*

  • cloudscheduler.jobs.create
  • cloudscheduler.jobs.delete
  • cloudscheduler.jobs.enable
  • cloudscheduler.jobs.fullView
  • cloudscheduler.jobs.get
  • cloudscheduler.jobs.list
  • cloudscheduler.jobs.pause
  • cloudscheduler.jobs.run
  • cloudscheduler.jobs.update
  • cloudscheduler.locations.get
  • cloudscheduler.locations.list

compute.machineTypes.get

compute.projects.get

compute.regions.list

compute.zones.list

dataflow.jobs.*

  • dataflow.jobs.cancel
  • dataflow.jobs.create
  • dataflow.jobs.get
  • dataflow.jobs.list
  • dataflow.jobs.snapshot
  • dataflow.jobs.updateContents

dataflow.messages.list

dataflow.metrics.get

dataflow.snapshots.*

  • dataflow.snapshots.delete
  • dataflow.snapshots.get
  • dataflow.snapshots.list

firebase.projects.get

iam.serviceAccounts.actAs

iam.serviceAccounts.get

iam.serviceAccounts.list

monitoring.timeSeries.create

orgpolicy.policy.get

pubsub.schemas.get

pubsub.topics.get

recommender.dataflowDiagnosticsInsights.*

  • recommender.dataflowDiagnosticsInsights.get
  • recommender.dataflowDiagnosticsInsights.list
  • recommender.dataflowDiagnosticsInsights.update

recommender.iamPolicyInsights.*

  • recommender.iamPolicyInsights.get
  • recommender.iamPolicyInsights.list
  • recommender.iamPolicyInsights.update

recommender.iamPolicyRecommendations.*

  • recommender.iamPolicyRecommendations.get
  • recommender.iamPolicyRecommendations.list
  • recommender.iamPolicyRecommendations.update

recommender.storageBucketSoftDeleteInsights.*

  • recommender.storageBucketSoftDeleteInsights.get
  • recommender.storageBucketSoftDeleteInsights.list
  • recommender.storageBucketSoftDeleteInsights.update

recommender.storageBucketSoftDeleteRecommendations.*

  • recommender.storageBucketSoftDeleteRecommendations.get
  • recommender.storageBucketSoftDeleteRecommendations.list
  • recommender.storageBucketSoftDeleteRecommendations.update

remotebuildexecution.blobs.get

resourcemanager.hierarchyNodes.listEffectiveTags

resourcemanager.projects.get

resourcemanager.projects.list

serviceusage.consumerpolicy.analyze

serviceusage.consumerpolicy.get

serviceusage.effectivepolicy.get

serviceusage.groups.*

  • serviceusage.groups.list
  • serviceusage.groups.listExpandedMembers
  • serviceusage.groups.listMembers

serviceusage.services.get

serviceusage.services.list

serviceusage.values.test

storage.anywhereCaches.*

  • storage.anywhereCaches.create
  • storage.anywhereCaches.disable
  • storage.anywhereCaches.get
  • storage.anywhereCaches.list
  • storage.anywhereCaches.pause
  • storage.anywhereCaches.resume
  • storage.anywhereCaches.update

storage.bucketOperations.*

  • storage.bucketOperations.cancel
  • storage.bucketOperations.get
  • storage.bucketOperations.list

storage.buckets.*

  • storage.buckets.create
  • storage.buckets.createTagBinding
  • storage.buckets.delete
  • storage.buckets.deleteTagBinding
  • storage.buckets.enableObjectRetention
  • storage.buckets.get
  • storage.buckets.getIamPolicy
  • storage.buckets.getIpFilter
  • storage.buckets.getObjectInsights
  • storage.buckets.list
  • storage.buckets.listEffectiveTags
  • storage.buckets.listTagBindings
  • storage.buckets.relocate
  • storage.buckets.restore
  • storage.buckets.setIamPolicy
  • storage.buckets.setIpFilter
  • storage.buckets.update

storage.folders.*

  • storage.folders.create
  • storage.folders.delete
  • storage.folders.get
  • storage.folders.list
  • storage.folders.rename

storage.intelligenceConfigs.*

  • storage.intelligenceConfigs.get
  • storage.intelligenceConfigs.update

storage.managedFolders.*

  • storage.managedFolders.create
  • storage.managedFolders.delete
  • storage.managedFolders.get
  • storage.managedFolders.getIamPolicy
  • storage.managedFolders.list
  • storage.managedFolders.setIamPolicy

storage.multipartUploads.*

  • storage.multipartUploads.abort
  • storage.multipartUploads.create
  • storage.multipartUploads.list
  • storage.multipartUploads.listParts

storage.objects.*

  • storage.objects.create
  • storage.objects.createContext
  • storage.objects.delete
  • storage.objects.deleteContext
  • storage.objects.get
  • storage.objects.getIamPolicy
  • storage.objects.list
  • storage.objects.move
  • storage.objects.overrideUnlockedRetention
  • storage.objects.restore
  • storage.objects.setIamPolicy
  • storage.objects.setRetention
  • storage.objects.update
  • storage.objects.updateContext

storagebatchoperations.*

  • storagebatchoperations.jobs.cancel
  • storagebatchoperations.jobs.create
  • storagebatchoperations.jobs.delete
  • storagebatchoperations.jobs.get
  • storagebatchoperations.jobs.list
  • storagebatchoperations.locations.get
  • storagebatchoperations.locations.list
  • storagebatchoperations.operations.cancel
  • storagebatchoperations.operations.delete
  • storagebatchoperations.operations.get
  • storagebatchoperations.operations.list

Data pipelines Viewer

(roles/datapipelines.viewer)

Viewer of Data pipelines resources

datapipelines.jobs.list

datapipelines.pipelines.get

datapipelines.pipelines.list

resourcemanager.projects.get

resourcemanager.projects.list

Data Pipelines permissions

PermissionIncluded in roles

datapipelines.jobs.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Data pipelines Admin (roles/datapipelines.admin)

Data pipelines Viewer (roles/datapipelines.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

datapipelines.pipelines.create

Owner (roles/owner)

Editor (roles/editor)

Data pipelines Admin (roles/datapipelines.admin)

datapipelines.pipelines.delete

Owner (roles/owner)

Editor (roles/editor)

Data pipelines Admin (roles/datapipelines.admin)

datapipelines.pipelines.get

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Data pipelines Admin (roles/datapipelines.admin)

Data pipelines Viewer (roles/datapipelines.viewer)

Support User (roles/iam.supportUser)

datapipelines.pipelines.list

Owner (roles/owner)

Editor (roles/editor)

Viewer (roles/viewer)

Data pipelines Admin (roles/datapipelines.admin)

Data pipelines Viewer (roles/datapipelines.viewer)

Security Admin (roles/iam.securityAdmin)

Security Auditor (roles/iam.securityAuditor)

Security Reviewer (roles/iam.securityReviewer)

Support User (roles/iam.supportUser)

datapipelines.pipelines.run

Owner (roles/owner)

Editor (roles/editor)

Data pipelines Admin (roles/datapipelines.admin)

Data pipelines Invoker (roles/datapipelines.invoker)

datapipelines.pipelines.stop

Owner (roles/owner)

Editor (roles/editor)

Data pipelines Admin (roles/datapipelines.admin)

datapipelines.pipelines.update

Owner (roles/owner)

Editor (roles/editor)

Data pipelines Admin (roles/datapipelines.admin)

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.